add details for servie account

aws/projects/edl-projects/edl-prod-7537837/README.md

@@ -34,7 +34,7 @@ This is the organization management account, and it holds the SSO configuration.
 
 ## Usage
 
-### AWS Configuration
+### AWS SSO Configuration
 
 Add this to `$HOME/.aws/config` on the EC2 instance.
 [download](aws-config.txt)
@@ -91,6 +91,138 @@ This is a one time check to make sure it's working after you set it up.
 }
 ```
 
+### AWS Service Account
+
+We recommend that you use the AWS SSO as much as possible, but we understand there are cases where a long-running session beyond
+the time permitted by SSO is necessary.  As such, we have created a configuration with an IAM Service account and the same access
+as the SSO role.
+
+* IAM Service Account
+  * s-edl-prod-7537837
+* AWS Secrets Manager Secret with the access key
+  * /local/iam/service_account/s-edl-prod-7537837-mkAAcD
+  * available through a tag to find the secret
+  * access to only this secret
+* Auto-rotation every 30 days of the access key
+  * The old key is removed, not marked inactive
+  * No notification on rotation
+* Utility to grab the access key and secret driven from SSO role
+  * get_service_account_creds.py
+
+### AWS Service Account Setup
+
+You will need to have logged into your AWS and set proxy and stuff as above.  Then, you'll create a new profile and use the utility pull
+the credentials into your `$HOME/.aws/config` and `$HOME/.aws/credentials`.
+
+#### Create New Profile
+
+This is a one time thing (per EC2).  The utility will replace _PLACEHOLDER_ with the proper value, but this is needed to get the `credentials` 
+file updated.
+
+```console
+% aws configure set region us-west-2 --profile 563127383709-edl-addcp-prod-ew.s-edl-prod-7537837
+% aws configure set aws_access_key_id PLACEHOLDER --profile 563127383709-edl-addcp-prod-ew.s-edl-prod-7537837
+```
+
+#### Get Access and Secret Key
+
+Next, you'll run the utility to update this newly created profile, or to just show them on the CLI. Flags and use:
+
+| Flag | Description |
+|--|--|
+| --profile | The SSO profile used for accessing the account |
+| --region |  The AWS Region where the secret exists (here, it's us-west-2 where all the Bedrock stuff lives too) |
+| --secret-name | The AWS Secrets Manager secret name |
+| --username |  The IAM Service account name (even though this is in the secret) |
+| --update-profile | The new service account profile |
+
+If you omit the --update-profile, it will output the environment variables.  Examples of both methods are below.
+
+* Update Profile
+
+```console
+% get_service_account_creds.py \
+  --profile 563127383709-edl-addcp-prod-ew.edl-prod-7537837 \
+  --region us-west-2 \
+  --secret-name /local/iam/service_account/s-edl-prod-7537837 \
+  --username s-edl-prod-7537837  \
+  --update-profile 563127383709-edl-addcp-prod-ew.s-edl-prod-7537837
+
+Retrieving secret '/local/iam/service_account/s-edl-prod-7537837' from us-west-2 using profile '563127383709-edl-addcp-prod-ew.edl-prod-7537837'...
+Updating AWS CLI profile '563127383709-edl-addcp-prod-ew.s-edl-prod-7537837'...
+  Backed up /home/b/badra001/.aws/credentials → /home/b/badra001/.aws/credentials.20260610T145031Z.bak
+  Backed up /home/b/badra001/.aws/config → /home/b/badra001/.aws/config.20260610T145031Z.bak
+  Updated /home/b/badra001/.aws/credentials — profile [563127383709-edl-addcp-prod-ew.s-edl-prod-7537837]
+  Updated /home/b/badra001/.aws/config — profile [profile 563127383709-edl-addcp-prod-ew.s-edl-prod-7537837]
+
+  IAM username : s-edl-prod-7537837
+  Last rotated : 2026-06-04T20:38:20.790812+00:00
+  Project      : edl
+  Environment  : prod
+  Project ID   : 7537837
+```
+
+* Show Environment Variables
+
+```console
+% get_service_account_creds.py \
+  --profile 563127383709-edl-addcp-prod-ew.edl-prod-7537837 \
+  --region us-west-2 \
+  --secret-name /local/iam/service_account/s-edl-prod-7537837 \
+  --username s-edl-prod-7537837 
+
+Retrieving secret '/local/iam/service_account/s-edl-prod-7537837' from us-west-2 using profile '563127383709-edl-addcp-prod-ew.edl-prod-7537837'...
+export AWS_ACCESS_KEY_ID="AKIAXXX"
+export AWS_SECRET_ACCESS_KEY="XXXXXX"
+export AWS_DEFAULT_REGION="us-west-2"
+
+# IAM username : s-edl-prod-7537837
+# Last rotated : 2026-06-04T20:38:20.790812+00:00
+# Project      : edl
+# Environment  : prod
+# Project ID   : 7537837
+```
+
+You may use this in an `eval` if you don't want to set a profile.
+
+```console
+% eval $(./get_service_account_creds.py --profile 563127383709-edl-addcp-prod-ew.edl-prod-7537837 --region us-west-2 --secret-name /local/iam/service_account/s-edl-prod-7537837 --username s-edl-prod-7537837
+ )
+Retrieving secret '/local/iam/service_account/s-edl-prod-7537837' from us-west-2 using profile '563127383709-edl-addcp-prod-ew.edl-prod-7537837'...
+
+% env|grep AWS
+AWS_SECRET_ACCESS_KEY=XXXXX
+AWS_DEFAULT_REGION=us-west-2
+AWS_ACCESS_KEY_ID=AKIAXXX
+```
+
+You can then test it out (with profile):
+
+```console
+% aws --profile 563127383709-edl-addcp-prod-ew.s-edl-prod-7537837 sts get-caller-identity
+{
+    "UserId": "AIDAYGHIB62O6CVF4CQVF",
+    "Account": "563127383709",
+    "Arn": "arn:aws:iam::563127383709:user/s-edl-prod-7537837"
+}
+```
+
+If you've set the environment variables, you would omit the `--profile NAME` part.
+
+```console
+% aws sts get-caller-identity
+{
+    "UserId": "AIDAYGHIB62O6CVF4CQVF",
+    "Account": "563127383709",
+    "Arn": "arn:aws:iam::563127383709:user/s-edl-prod-7537837"
+}
+```
+
+You can now use this new profile (or ENV if you prefer).
+
+There is no notification when it is rotating or has rotated.  The rotation schedule is outside of the secret
+and subject to change.  Please make note of the rotation date and update after it rotates.
+
 ### Show Infrerence Profile
 
 This will show you the application inference profile setup (for cost tracking).
@@ -220,3 +352,6 @@ And execute:
   - update comments now that logging is working
 - 1.1.0 -- 2026-06-04
   - add opus 4.8 details
+- 1.2.0 -- 2026-06-10
+  - add details for service account
+